---
title: "Mint a retention cutoff ticket"
method: POST
path: "/vaults/v1/{vault_id}/retention-cutoffs"
tags: ["vault"]
---

# Mint a retention cutoff ticket

`POST /vaults/v1/{vault_id}/retention-cutoffs`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/retention-cutoffs`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - HTTP bearer

Issues the service-signed `retention_cutoff` a checkpoint-bearing head receipts. `cutoff_at` is SERVER-authoritative — root-expiry arithmetic is evaluated against a clock the client does not propose. The ticket is stored create-only and registered before it is returned, so the `receipt` below is a receipt for bytes that already exist; receipt it from the head's `checkpoint.cutoff` block and admit before it expires.

## Path parameters

- `vault_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `base_head_sha256` string, required: The head the cutoff is taken against, 64 lowercase hex.

## Response `201`

Ticket issued and stored

- object
  - `ticket` object: The complete signed retention_cutoff object.
  - `receipt` object
    - `object_id` string, required
    - `object_kind` 'retention_cutoff', required
    - `stored_bytes_sha256` string, required
    - `size_bytes` string, required: Decimal byte count as a string (values exceed 2^53).
  - `next_actions` object[]

## Other responses

- `400`: VALIDATION_FAILED — base_head_sha256 is not 64 lowercase hex
- `403`: VAULT_ACCESS_DENIED
- `503`: SERVICE_UNAVAILABLE — storage or the service signing key is not provisioned

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)